import struct, sys, io
sys.stdout = io.TextIOWrapper(sys.stdout.buffer, encoding='utf-8', errors='replace')
data = open('HAVOC_NOCD.EXE','rb').read()
FO2VA = lambda fo: fo + 0x400C00
VA2FO = lambda va: va - 0x400C00

# Read PE entry point
e_lfanew = struct.unpack_from('<I', data, 0x3c)[0]
ep_rva = struct.unpack_from('<I', data, e_lfanew + 0x28)[0]
ep_va = 0x400000 + ep_rva
ep_fo = ep_rva - 0xC00  # .text: rawoff=0x400, VirtualAddress=0x1000, so FO = VA - 0x400C00
print("Entry point: RVA 0x%x VA 0x%x FO 0x%x" % (ep_rva, ep_va, ep_fo))

def show(start, length):
    for row in range(start, start + length, 16):
        chunk = data[row:row+16]
        ann = []
        for j in range(len(chunk)):
            f = row + j
            try:
                if data[f] == 0xe8 and f+5 <= len(data):
                    rel = struct.unpack_from('<i', data, f+1)[0]
                    tgt = (FO2VA(f+5) + rel) & 0xFFFFFFFF
                    ann.append('+%d:CALL_0x%x' % (j, tgt))
                if data[f] == 0xff and data[f+1] == 0x15 and f+6 <= len(data):
                    iat = struct.unpack_from('<I', data, f+2)[0]
                    d = {
                        0x4822f4:'DirectDrawCreate', 0x4822fc:'DirectSoundCreate',
                        0x48240c:'ExitProcess', 0x48248c:'MessageBoxA',
                        0x4823cc:'LocalAlloc', 0x482370:'VirtualAlloc',
                        0x482390:'CreateFileA', 0x482398:'GetModuleHandleA',
                        0x48249c:'GetCommandLineA', 0x48238c:'GetStartupInfoA',
                        0x4823a8:'SetFileAttributesA',
                        0x482438:'HeapCreate', 0x4824c8:'InitializeCriticalSection',
                    }
                    ann.append('+%d:[%s]' % (j, d.get(iat, 'iat_0x%x' % iat)))
                if data[f] == 0xa3 and f+5 <= len(data):
                    va = struct.unpack_from('<I', data, f+1)[0]
                    if 0x47C000 <= va <= 0x482000:
                        ann.append('+%d:MOV[0x%x],EAX' % (j, va))
                if data[f] == 0xc3: ann.append('+%d:RET' % j)
                if data[f] == 0xc2 and f+3 <= len(data):
                    n = struct.unpack_from('<H', data, f+1)[0]
                    ann.append('+%d:RET%d' % (j, n))
            except Exception:
                pass
        line = 'FO 0x%05x VA 0x%07x: %s' % (row, FO2VA(row), ' '.join('%02x' % b for b in chunk))
        if ann:
            line += '  [%s]' % ','.join(ann)
        print(line)

print()
print("=== Entry point ===")
show(ep_fo, 128)

print()
print("=== function 0x4283F0 (first call in init 0x418600) at FO 0x%05x ===" % VA2FO(0x4283F0))
show(VA2FO(0x4283F0), 96)